Schedule a Demo

Cyber Security

Cyber Security
Cyber Security

Vshell Gains Traction Among Threat Actors as an Alternative to Cobalt Strike

vshell-gains-traction-among-threat-actors-as-an-alternative-to-cobalt-strike

A Go-based command-and-control (C2) framework originally marketed within Chinese-speaking offensive security communities has been quietly expanding its reach, drawing growing attention from threat actors seeking flexible and cost-effective alternatives to expensive commercial tools. Known as Vshell, the tool has evolved well beyond its early roots as a basic remote access tool (RAT) and now poses […]

New Dohdoor Malware Attacking Schools and Health Care Sectors in U.S. via Multi-Stage Attack Chain

new-dohdoor-malware-attacking-schools-and-health-care-sectors-in-us.-via-multi-stage-attack-chain

A newly discovered malware campaign has been quietly targeting educational institutions and healthcare organizations across the United States since at least December 2025. The threat, tracked under the actor designation “UAT-10027,” deploys a previously unknown backdoor called “Dohdoor,” which uses an advanced combination of stealth techniques and multi-stage delivery to gain persistent access into victim […]

Critical Trend Micro Apex One Vulnerabilities Allows Malicious Code Execution

critical-trend-micro-apex-one-vulnerabilities-allows-malicious-code-execution

Trend Micro Apex One Vulnerabilities Trend Micro has released fixes for multiple Apex One vulnerabilities, ranging from High to Critical severity, including management console issues that can lead to remote code execution (RCE). The affected CVEs range from CVE-2025-71210 to CVE-2025-71217, with CVSS v3 scores ranging from 7.2 to 9.8.​ The February 2026 advisory lists Apex One […]

North Korean APT37 Hackers Leverages Novel Malware to Infect AirGapped Systems

north-korean-apt37-hackers-leverages-novel-malware-to-infect-airgapped-systems

North Korea-linked threat group APT37 has launched a sophisticated new campaign using a fresh set of custom malware tools specifically designed to reach computers that are not connected to the internet — a type of system long considered among the most secure in the world. The campaign, dubbed Ruby Jumper, marks a sharp escalation in the […]

PhishingLed Agent Tesla Campaign Uses Process Hollowing and AntiAnalysis to Evade Detection

phishingled-agent-tesla-campaign-uses-process-hollowing-and-antianalysis-to-evade-detection

A newly uncovered phishing campaign is delivering Agent Tesla, one of the most widely used credential-stealing malware families, through a multi-stage attack chain that leaves almost no trace on a victim’s machine. The campaign uses business-themed phishing emails, obfuscated scripts, and in-memory execution to silently harvest sensitive data from Windows users. With its ability to […]

ResidentBat Android Malware Provides Belarusian KGB with Persistent Access to Mobile Devices

residentbat-android-malware-provides-belarusian-kgb-with-persistent-access-to-mobile-devices

A newly documented Android spyware called ResidentBat has been linked to the Belarusian KGB, giving state operators deep and persistent access to the mobile devices of journalists and civil society members. First publicly reported in December 2025 through a joint investigation by Reporters Without Borders (RSF) and RESIDENT.NGO, the malware’s code history suggests it was quietly developed […]

Google Disrupts Chinese Hackers Infrastructre which Breached 53 Telecom and Government Entities

google-disrupts-chinese-hackers-infrastructre-which-breached-53-telecom-and-government-entities

A suspected Chinese state-linked hacking group has been caught running one of the most far-reaching cyber espionage operations ever uncovered — silently breaching telecom providers and government bodies across four continents for nearly a decade. Google has now stepped in to dismantle that operation entirely, severing the group’s persistent access and releasing threat intelligence to […]

Hackers Can Abuse Cortex XDR Live Terminal Feature for C2 Communications

hackers-can-abuse-cortex-xdr-live-terminal-feature-for-c2-communications

A newly disclosed research finding has revealed that Palo Alto Networks’ Cortex XDR Live Terminal feature can be turned into a command-and-control (C2) channel by attackers. Since this feature runs inside a trusted endpoint detection and response (EDR) agent, the traffic it produces is largely accepted by enterprise security tools, making this a quiet and […]

Threat Actors Weaponized AI Tools to Gain Full Domain Access within 30 Minutes

threat-actors-weaponized-ai-tools-to-gain-full-domain-access-within-30-minutes

In 2025, threat actors turned widely used artificial intelligence tools into weapons for launching fast, precise network intrusions. CrowdStrike’s 2026 Global Threat Report found an 89% year-over-year increase in attacks by AI-enabled adversaries, as criminals used automation and machine-generated scripts to cut the time between initial entry and full domain access to under 30 minutes. […]